Docs

Appearance

Kill Chain — Persistence Agent Response ​

When this fires: persistence_agent detected unauthorized persistence — new Windows service (EventID 7045), new scheduled task (EventID 4698), or registry run key modification (FIM/ConfigurationChange) — outside a CM window.

Severity: HIGH (escalates to CRITICAL if the service binary path is in a user-writable location).

MITRE: T1543.003 (Create or Modify System Process: Windows Service), T1053.005 (Scheduled Task/Job), T1547.001 (Boot or Logon Autostart: Registry Run Keys)

Immediate Triage — Within 15 Minutes ​

  1. Open the SecOps finding. Note: host, item type (service/task/registry), item name, binary path or action, account, timestamp
  2. Check for a CM ticket: SecOps → Change Management → filter by host and time window, or GET /api/changes/recent
    • If a valid CM ticket covers this host at this time: close the finding, add a known-good rule with expiry matching the CM window
  3. Check whether the creating account is a known IT/deployment account
  4. Check if the same host has execution or credential dumping findings in the same SecOps window — if yes, treat as active attack chain regardless of CM status

Investigation KQL ​

kql
// New service installed (EventID 7045)
SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID == 7045
| where Computer has "<hostname>"
| extend ServiceName = tostring(EventData.ServiceName)
| extend ServicePath = tostring(EventData.ImagePath)
| extend ServiceType = tostring(EventData.ServiceType)
| project TimeGenerated, Computer, ServiceName, ServicePath, ServiceType, Account
kql
// New scheduled task (EventID 4698)
SecurityEvent
| where TimeGenerated > ago(4h)
| where EventID == 4698
| where Computer has "<hostname>"
| extend TaskName = tostring(EventData.TaskName)
| extend TaskContent = tostring(EventData.TaskContent)
| project TimeGenerated, Computer, Account, TaskName, TaskContent
kql
// Registry run key modification (FIM)
ConfigurationChange
| where TimeGenerated > ago(4h)
| where ConfigChangeType == "Registry"
| where Computer has "<hostname>"
| where RegistryKey has_any ("\\CurrentVersion\\Run", "\\CurrentVersion\\RunOnce", "\\Winlogon")
| project TimeGenerated, Computer, RegistryKey, RegistryValueName, RegistryValueData, ChangeCategory

Response by Item Type ​

New Service (EventID 7045) ​

  1. Look up the service binary path. Is it in a user-writable location (Temp, AppData, Users)?
    • Yes: CRITICAL path — stop and disable the service immediately, isolate the host
    • No: verify with the account owner whether this service is legitimate
  2. Compute the SHA256 hash of the service binary:
    powershell
    Get-FileHash "C:\path\to\service.exe" -Algorithm SHA256
  3. Check the hash on VirusTotal and in Cortex (search hash in Cortex XDR console → Threat Intel)
  4. If the service is legitimate: create a retrospective CM ticket in SecOps with the justification
  5. If unauthorized: stop and disable, then continue investigation
powershell
# Stop and disable the service
sc.exe stop "<ServiceName>"
sc.exe config "<ServiceName>" start= disabled

New Scheduled Task (EventID 4698) ​

  1. Review the task action and trigger from the EventData or Task Scheduler UI
  2. Identify what the task runs and who created it
  3. Check the task content from LAW (the KQL above includes TaskContent)
  4. If unauthorized:
    powershell
    Unregister-ScheduledTask -TaskName "<TaskName>" -Confirm:$false

Registry Run Key Modification (FIM) ​

  1. Identify what executable the run key points to
  2. Compute SHA256 and check threat intel
  3. If unauthorized or suspicious:
    powershell
    Remove-ItemProperty `
  -Path "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" `
  -Name "<ValueName>"
  4. For HKCU keys, you need to run the command in the context of the affected user

Combined Kill Chain Context ​

If persistence fires alongside execution findings on the same host in the same window:

  • Treat as stage 2 + 3 of a ransomware attack (execution then persistence)
  • Escalate to Rory immediately and contact Arctic Wolf
  • Do not just remove the persistence mechanism — the execution may have already done its work

Escalation ​

  • HIGH finding with no kill chain correlation: notify Rory, investigate and remediate
  • HIGH finding correlated with execution/credential findings: CRITICAL path — Rory + Arctic Wolf immediately
  • CRITICAL (binary in user-writable path): Rory + Arctic Wolf, isolate host

Post-Incident Checklist ​

  • [ ] Persistence mechanism removed (service stopped/disabled, task deleted, registry key removed)
  • [ ] Root cause identified (phishing, insider, software deployment?)
  • [ ] Host status determined: clean or reimaging required?
  • [ ] CM processes reviewed: was this a change that should have had a ticket?
  • [ ] Known-good rule added if legitimate (so future installs of this service don't fire)
  • [ ] HIPAA breach assessment if ePHI host involved
  • runbooks/kill-chain-execution-response.md — execution often precedes persistence
  • runbooks/secops-change-management.md — CM ticket creation
  • runbooks/known-good-rule-management.md — managing suppression rules for legitimate services
  • compliance/hipaa-breach-notification-procedure.md — if ePHI host involved

Internal use only — Cirius Group